METHOD AND SYSTEM FOR CLOUD BASED STORAGE

• US 20120204030A1
• Filed: 02/03/2012
• Published: 08/09/2012
• Est. Priority Date: 02/03/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Cloudlink Technologies, Inc. (Dell Technologies Inc.)
• Inventors: Nossik, Misha, Dumitrescu, Razvan, Du, Lejin, You, Zhengping, Berfeld, Yuri
• Granted Patent: US 9,021,264 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A method is disclosed wherein a first virtual machine is provided in execution. A storage area network for storing of data of the first virtual machine is also provided. A second virtual machine is executed for receiving first data from the first virtual machine for storage within the storage area network and for securing the first data to form secured first data and for storing the secured first data within the storage area network.

Claims

1. A method comprising:

providing a first virtual machine in execution;

providing a storage area network for storing of data of the first virtual machine; and

providing a second virtual machine for receiving first data from the first virtual machine for storage within the storage area network and for securing the first data to form secured first data and for storing the secured first data within the storage area network.

2. A method according to claim 1 wherein the second virtual machine encrypts the first data using an encryption key data provided by an enterprise, the enterprise a same enterprise for whom the first virtual machine is in execution.

3. A method according to claim 2 wherein the first virtual machine is in execution exclusively for the same enterprise.

4. A method according to claim 3 wherein the encryption key data is provided from a key manager.

5. A method according to claim 4 wherein second virtual machine is authenticated to a process in execution within the enterprise prior to receiving the encryption key data and wherein the process within the enterprise requests the encryption key data from the key manager for provision to the second virtual machine.

6. A method according to claim 5 comprising providing a third virtual machine for maintaining a secure communication with the enterprise, the third virtual machine for being authenticated to a process in execution within the enterprise.

7. A method according to claim 6 wherein being authenticated comprises a process requiring manual provision of authentication data.

8. A method according to claim 6 wherein being authenticated comprises an automated virtual machine authentication method.

9. A method according to claim 6 wherein the third virtual machine comprises a wNode and wherein the second virtual machine comprises an sNode.

10. A method according to claim 1 wherein the second virtual machine forms part of a disaster recovery system.

11. A method according to claim 10 comprising providing a fourth virtual machine for execution within the enterprise, the fourth virtual machine for performing an identical function to the first virtual machine, the first virtual machine for, upon failure of the fourth virtual machine, performing said function.

12. A method according to claim 1 comprising:

providing a third virtual machine for receiving data from an enterprise and for providing the data to the first virtual machine for provision to the second virtual machine.

13. A method according to claim 1 comprising:

providing a third virtual machine for receiving data from an enterprise and for providing the data to the first virtual machine for processing thereof.

14. A method according to claim 1 wherein the second virtual machine forms part of a capacity planning system.

15. A method comprising:

providing a first process in execution within an enterprise and for storing of data;

providing a second process in execution within the enterprise for communicating with a cloud based service;

providing third process within the cloud for receiving backup data from the second process for storage within the cloud; and

a fourth process within the cloud for receiving the backup data and for securing the backup data for storage and for providing the secured backup data to a storage area network for storage thereof.

18. A method according to claim 15 wherein the process for securing data receives data from a plurality of processes, each of the plurality of processes uniquely associated with a same enterprise.

21. A method according to claim 18 comprising a securing process for securing data that receives data from at least an other process uniquely associated with a different enterprise.

16. A method comprising:

providing a first process in execution within an enterprise and for storing of data;

providing a second process in execution within the enterprise for communicating with a cloud based service;

providing a third process within the cloud for receiving backup data from the second process for processing within the cloud;

providing a fifth process within the cloud for receiving the backup data and for processing thereof and for providing the processed backup data; and

providing a fourth process within the cloud for receiving the processed backup data and for securing the backup data for storage and for providing the secured backup data to a storage area network for storage thereof.

19. A method according to claim 16 wherein the process for securing data receives data from a plurality of processes, each of the plurality of processes uniquely associated with a same enterprise.

17. A method comprising:

providing a first process in execution within an enterprise and for storing of data;

providing a second process in execution within the enterprise for communicating with a cloud based service;

providing a third process within the cloud for receiving backup data from the second process for processing within the cloud;

providing a fifth process within the cloud for receiving the backup data and for providing the backup data; and

providing a fourth process within the cloud for receiving the backup data from the fifth process and for securing the backup data for storage and for providing the secured backup data to a storage area network for storage thereof.

20. A method according to claim 17 wherein the process for securing data receives data from a plurality of processes, each of the plurality of processes uniquely associated with a same enterprise.

22. A system comprising a cloud based processor and a cloud based storage area network, the cloud based processor for executing a first virtual machine for securing data for being stored within the storage area network;

and an enterprise processor for interfacing with a key manager and for authenticating the first virtual machine in order to one of enable provision of encryption key data thereto or deny provision of encryption key data thereto.

23. A system according to claim 22 comprising a key manager.

24. A method comprising:

providing a first virtual machine in execution;

providing a storage area network for storing of data of the first virtual service; and

providing a second virtual machine for receiving first data from the first virtual machine for storage within the storage area network and for securing the first data to form secured first data and for storing the secured first data within the storage area network.

25. A method comprising:

providing a first virtual service in execution;

providing a storage area network for storing of data of the first virtual service; and

providing a second virtual service for receiving first data from the first virtual service for storage within the storage area network and for securing the first data to form secured first data and for storing the secured first data within the storage area network.

26. A method according to claim 25 wherein the second virtual service encrypts the first data using an encryption key data provided by an enterprise, the enterprise a same enterprise for whom the first virtual service is in execution.

27. A method according to claim 26 wherein the first virtual service is in execution exclusively for the same enterprise.

28. A method according to claim 27 wherein the encryption key data is provided from a key manager.

29. A method according to claim 28 wherein second virtual service is authenticated to a process in execution within the enterprise prior to receiving the encryption key data and wherein the process within the enterprise requests the encryption key data from the key manager for provision to the second virtual service.

30. A method according to claim 27 comprising a third virtual service for maintaining a secure communication with the enterprise, the third virtual service for being authenticated to a process in execution within the enterprise.

31. A method according to claim 30 wherein being authenticated comprises a process requiring manual provision of authentication data.

32. A method according to claim 30 wherein being authenticated comprises an automated virtual machine authentication method.

33. A method according to claim 30 wherein the third virtual service comprises a wNode and wherein the second virtual service comprises an sNode.

34. A method according to claim 25 wherein the second virtual service forms part of a disaster recovery system.

35. A method according to claim 27 comprising providing a fourth virtual service for execution within the enterprise, the fourth virtual service for performing an identical function to the first virtual service, the first virtual service for, upon failure of the fourth virtual service, performing said function.

36. A method according to claim 25 comprising:

providing a third virtual service for receiving data from an enterprise and for providing the data to the first virtual service for provision to the second virtual service.

37. A method according to claim 25 comprising:

providing a third virtual service for receiving data from an enterprise and for providing the data to the first virtual service for processing thereof.

38. A method according to claim 25 wherein the first virtual service is for execution within a first virtual machine and the second virtual service is for execution within a second other virtual machine.